Alerting

Dedup by time

arkonner
Path Finder

I am using the search below to determine the account locked out - It works fine but as result I received more than a single account locked-out events from at list two domain controllers between 2 seconds - Should be possible to use a dedup by time to avoid the same status over 5/10 seconds.

index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND  Account_Name!=Anonymous   | eval Account_Name = mvindex(Account_Name,1)   | eval Security_ID = mvindex(Security_ID,1)  | timechart span=1h limit=20 useother=f count by Account_Name
Tags (3)
0 Karma

koshyk
Super Champion

I would do a stats rather than a dedup as it is much efficient & fast

0 Karma

gokadroid
Motivator

If all the data in the event seems duplicate please try to see if dedup _raw at the beginning solves your problem. If still the duplicate events exist it means there is something different between raw data of these two events even though the specific data you seek might look duplicate.

Doing a dedup over _time might not solve the issue since you mention that after 2 seconds the event reappears (which means time itself is different). Try dedup over the fields which you see are coming as duplicate rather than time which itself is 2sec different to previous duplicate event.

0 Karma

arkonner
Path Finder

The same event has been recorded by more than one domain controller - " count by Account_Name" is showing two events coming from server1 and server2 - in closing time - I am looking to eliminate the duplication if this append in a 5/10 sec time windows - If the same user i still strying to perform a login the new account_locked out will appear.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...